CVE-2026-83989: Windows 10 1607 NFS ONCRPC XDR DOS Flaw

CVE-2026-83989 is a denial of service vulnerability in Windows Services for NFS ONCRPC XDR Driver on Windows 10 1607. An out-of-bounds read allows network-based attackers to disrupt service availability. This article covers technical details, affected versions, impact assessment, and mitigation strategies.

CVE-2026-83989 Overview

CVE-2026-83989 is an out-of-bounds read vulnerability [CWE-125] in the Microsoft Windows Services for Network File System (NFS) Open Network Computing Remote Procedure Call (ONCRPC) External Data Representation (XDR) Driver. An unauthenticated remote attacker can trigger the flaw over the network to cause a denial of service (DoS) on affected systems. The vulnerability affects a broad range of Windows client and server releases where the NFS role or feature is present. No user interaction or privileges are required for exploitation, which lowers the barrier for network-based abuse against exposed NFS endpoints.

Critical Impact
Remote, unauthenticated attackers can crash or destabilize the ONCRPC XDR Driver, disrupting NFS services and any workloads dependent on them.

Affected Products

Microsoft Windows 10 (1607, 1809, 21H2, 22H2) across x86, x64, and ARM64
Microsoft Windows 11 (23H2, 24H2, 25H2, 26H1) across x64 and ARM64
Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025

Discovery Timeline

2026-09-08 - CVE-2026-83989 published to the National Vulnerability Database (NVD)
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-83989

Vulnerability Analysis

The flaw resides in the Windows Services for NFS ONCRPC XDR Driver, which parses XDR-encoded ONCRPC messages used by NFS clients and servers. An out-of-bounds read occurs when the driver processes a crafted request whose length or offset fields point beyond the allocated buffer boundary. Reading past the buffer end triggers an access violation in kernel context, which halts the driver and disrupts NFS-dependent services. Because the driver operates at kernel level, the fault can propagate to a system stop condition. The attack requires only network reachability to the vulnerable service.

Root Cause

The root cause is missing or insufficient bounds validation while deserializing XDR-encoded fields from ONCRPC traffic. The driver trusts attacker-supplied length values without confirming they fit within the receive buffer, leading to a read beyond the allocated region [CWE-125].

Attack Vector

Exploitation is performed over the network by sending a malformed ONCRPC request to a Windows host running the NFS server role or the Services for NFS feature. No authentication or user interaction is required. The result is a denial of service against the NFS subsystem and, depending on kernel state, potentially the host itself. Refer to the Microsoft CVE-2026-83989 Advisory for vendor-specific technical details.

Detection Methods for CVE-2026-83989

Indicators of Compromise

Unexpected crashes or restarts of the NfsSvr, NfsClnt, or related ONCRPC services on Windows hosts
Kernel bug checks (BSOD) referencing the ONCRPC XDR driver in memory dumps
Bursts of malformed RPC traffic to TCP/UDP port 111 (portmapper) or port 2049 (NFS) from untrusted sources

Detection Strategies

Monitor Windows Event Log for Service Control Manager events showing repeated NFS service termination or recovery actions
Inspect network traffic to NFS-enabled hosts for oversized or malformed XDR length fields in ONCRPC PDUs
Correlate kernel crash telemetry with inbound NFS traffic to identify remote triggers

Monitoring Recommendations

Alert on any exposure of TCP/UDP 111 and 2049 to untrusted networks or the public internet
Track the availability and uptime of NFS services on Windows Server hosts running the NFS role
Baseline normal NFS client populations and flag new or anomalous sources initiating RPC calls

How to Mitigate CVE-2026-83989

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-83989 Advisory to all affected Windows client and server systems
Inventory all hosts with the Services for NFS role or feature installed and prioritize internet-facing systems
Restrict inbound access to NFS ports (111 and 2049) to trusted management and client networks only

Patch Information

Microsoft has published guidance and updates through the Microsoft Security Response Center. Administrators should consult the Microsoft CVE-2026-83989 Advisory for build-specific update packages covering Windows 10, Windows 11, and Windows Server 2012 through 2025.

Workarounds

Disable the Services for NFS server role on hosts that do not require NFS functionality
Enforce network segmentation and firewall rules that block RPC (port 111) and NFS (port 2049) traffic from untrusted zones
Use IPsec or VPN tunnels to authenticate and constrain which clients can reach NFS endpoints until patches are deployed